8886 matches found
CVE-2024-11913 Activity Plus Reloaded for BuddyPress <= 1.1.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajaxpreviewlink' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web...
PT-2025-5542 · Unknown · Yannick Lefebvre Bug Library
Name of the Vulnerable Software and Affected Versions: Yannick Lefebvre Bug Library versions n/a through 2.1.4 Description: The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command, which allows Blind SQL Injection...
PT-2025-5424
Name of the Vulnerable Software and Affected Versions I Thirteen Web Solution Email Subscription Popup versions 1.2.23 and earlier Description The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as SQL Injection, which allows Blind SQL...
Exploit for CVE-2025-22785
CVE-2025-22785 Course Booking System = 5.0.12 AND time-based b...
CVE-2025-23931
CVE-2025-23931 is a SQL Injection vulnerability affecting WordPress Local SEO (WordPress Local SEO plugin) up to version 2.3. The issue stems from improper neutralization of input in SQL commands, enabling Blind SQL Injection. Public references show the CVE-2025-23931 entry, with an explicit affe...
CVE-2025-23931 WordPress WordPress Local SEO plugin <= 2.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Oliver Fuhrmann WordPress Local SEO dh-local-seo allows Blind SQL Injection.This issue affects WordPress Local SEO: from n/a through = 2.3...
CVE-2025-23931 WordPress WordPress Local SEO plugin <= 2.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Oliver Fuhrmann WordPress Local SEO dh-local-seo allows Blind SQL Injection.This issue affects WordPress Local SEO: from n/a through = 2.3...
Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify
Summary This vulnerability allows a user to maneuver the Webfinger mechanism to perform a GET request to any internal resource on any Host, Port, URL combination regardless of present security mechanisms, and forcing the victim’s server into an infinite loop causing Denial of Service. Moreover,...
GHSA-C59P-WQ67-24WX Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify
Summary This vulnerability allows a user to maneuver the Webfinger mechanism to perform a GET request to any internal resource on any Host, Port, URL combination regardless of present security mechanisms, and forcing the victim’s server into an infinite loop causing Denial of Service. Moreover,...
CVE-2025-22710
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce allows Blind SQL Injection.This issue affects Smart Manager: from n/a through = 8.52.0...
CVE-2025-23221
Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. This vulnerability allows a user to maneuver the Webfinger mechanism to perform a GET request to any internal resource on any Host, Port, URL combination regardless of present security...
CVE-2025-23221 Fedify has an Infinite loop and Blind SSRF found inside the Webfinger mechanism
Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. This vulnerability allows a user to maneuver the Webfinger mechanism to perform a GET request to any internal resource on any Host, Port, URL combination regardless of present security...
CVE-2025-23221
Summary: CVE-2025-23221 affects Fedify’s Webfinger handling, enabling an attacker to abuse lookupWebFinger to trigger an endless redirect loop and potential Blind SSRF, leading to Denial of Service. Multiple sources (Red Hat, NVD/NVD-like entries, OSV, GHSA advisories, Veracode) describe the issu...
CVE-2025-23221 Fedify has an Infinite loop and Blind SSRF found inside the Webfinger mechanism
Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. This vulnerability allows a user to maneuver the Webfinger mechanism to perform a GET request to any internal resource on any Host, Port, URL combination regardless of present security...
CVE-2025-23221 Fedify has an Infinite loop and Blind SSRF found inside the Webfinger mechanism
Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. This vulnerability allows a user to maneuver the Webfinger mechanism to perform a GET request to any internal resource on any Host, Port, URL combination regardless of present security...
Exploit for CVE-2025-22710
CVE-2025-22710 1️⃣ Component type WordPress plugin 2️...
PT-2025-4752 · Ddsn Interactive · Ddsn Interactive Cm3 Acora Cms
Name of the Vulnerable Software and Affected Versions: DDSN Interactive cm3 Acora CMS version 10.1.1 Description: The issue is caused by insufficient input sanitization and validation in the table parameter, leading to an unauthenticated time-based blind SQL Injection. This allows attackers to...
CVE-2023-37931
The CVE corresponds to Fortinet FortiVoice Entreprise SQL injection, where improper neutralization of SQL elements enables a blind SQLi via crafted HTTP/HTTPS requests. Affected: FortiVoice Entreprise 7.0.0–7.0.1 and older than 6.4.8. Impact: authenticated attacker can perform a blind SQL injecti...
Fortinet FortiVoice Entreprise SQL注入漏洞
Fortinet FortiVoice Entreprise is a suite of enterprise unified communications solutions from Fortinet, Inc. A SQL injection vulnerability exists in Fortinet FortiVoice Entreprise versions 7.0.0 through 7.0.1 and prior to 6.4.8, which stems from improper neutralization of a special element and...